CVE-2026-86856 Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption...

CVE-2026-86856

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption. Mitigation Avoid using the nfp vDPA driver in production until patched. Do not attach untrusted...

Linux Distros Unpatched Vulnerability : CVE-2026-86856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leadin...

PT-2026-114311

Name of the Vulnerable Software and Affected Versions DPDK nfp vDPA driver affected versions not specified Description A flaw in the nfp vDPA driver allows stack and heap buffers, which are sized for a single queue pair, to be overflowed when multiple virtqueues are configured. This can result in...

CVE-2026-86856: Out-of-bounds Write

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: nfp: flower: Fixed a potential leak in nfptunneladdsharedmac. idasimpleget returns an ID that is between min 0 and max NFPMAXMACINDEX, including both values. Therefore, NFPMAXMACINDEX 0xff is a valid ID. For the error handling...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: nfp: Fixed a memory leak in nfpcppareacacheadd. In line 800 1, nfpcppareaalloc allocates and initializes a CPP area structure. However, in line 807 2, when the cache allocation fails, this CPP area structure is not freed, resulti...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handling of actinetdevs allocation failures The kmallocarray function in nfpfllagdowork will return null if physical memory runs out. As a result, if we dereference actinetdevs, null pointer dereferencing bugs may...

SUSE CVE-2026-98028

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: drop the replaced rule from the list when reprogramming fails nfpnetfsadd replaces an existing rule by deleting it from the hardware, decrementing nn-fs.count and programming the new one. If nfpnetfsaddhw fails the old...

SUSE CVE-2026-98029

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

CVE-2026-98029

A flaw was found in the Linux kernel's Netronome Flow Processor NFP network driver. The driver fails to validate the user-provided buffer size when retrieving network flow steering rules. An unprivileged local user can exploit this vulnerability to trigger an out-of-bounds memory write or a null...

DEBIAN-CVE-2026-98029

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

DEBIAN-CVE-2026-98028

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: drop the replaced rule from the list when reprogramming fails nfpnetfsadd replaces an existing rule by deleting it from the hardware, decrementing nn-fs.count and programming the new one. If nfpnetfsaddhw fails the old...

CVE-2026-98028

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: drop the replaced rule from the list when reprogramming fails nfpnetfsadd replaces an existing rule by deleting it from the hardware, decrementing nn-fs.count and programming the new one. If nfpnetfsaddhw fails the old...

CVE-2026-98029

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

UBUNTU-CVE-2026-98029

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

UBUNTU-CVE-2026-98028

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: drop the replaced rule from the list when reprogramming fails nfpnetfsadd replaces an existing rule by deleting it from the hardware, decrementing nn-fs.count and programming the new one. If nfpnetfsaddhw fails the old...

CVE-2026-98029

The Linux kernel contains a vulnerability in the nfp driver where the nfp_net_get_fs_loc() function fails to check the cmd->rule_cnt when dumping entries into the rule_locs[] buffer. Because ETHTOOL_GRXCLSRLALL does not require CAP_NET_ADMIN privileges and uses a user-supplied rule_cnt to size...

CVE-2026-98029 eth: nfp: bound the ntuple rule dump by the caller's buffer size

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

EUVD-2026-86682

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...